Performance of Photon-Pair Quantum Key Distribution Systems 
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We analyze the quantitative improvement in performance provided by a novel quantum key distri- 
bution (qkd) system that employs a correlated photon source (CPS) and a photon-number resolving 
detector (pnr). Our calculations suggest that given current technology, the CPS/pnr implementa- 
tion offers an improvement of several orders of magnitude in secure bit rate over previously described 
implementations. 



I. INTRODUCTION 

While much progress has been made in the field of 
experimental quantum key distribution (qkd) since the 
first proof-of- principle in 1992 jl], the failure of the exper- 
imental community to choose a well-defined scope for the 
technological power of the eavesdropper has made com- 
paring the competing implementations difficult. Specif- 
ically, the mean number of photons per pulse is arbi- 
trarily set at approximately 0.1 photons per pulse by 
most groups. There are two problems with operating 
the source at this power. First, since this mean value is 
not determined by maximizing the appropriate figure of 
merit (i.e., secure bits per pulse), each implementation 
must be assumed to be operated at a sub-optimal point 
in the parameter space, making it difficult to quantify 
the performance advantage enjoyed by one system over 
another. Second, recent work has shown that the choice 
of 0.1 photons per pulse makes all existing weak coher- 
ent pulse implementations insecure to an eavesdropper 
armed with foreseeable, though not presently available, 
technology 

In this paper, we combine reported experimental re- 
sults in the literature with a specific scope for the eaves- 
dropper and Liitkenhaus' fully secure version ^ of the 
BB84 protocol Q to determine which of three physi- 
cal implementations provides the best performance for 
free-space and optical fiber applications. The first two 
implementations, based on weak coherent pulses (wcp) 
and correlated photon sources (CPS) respectively, have 
been investigated elsewhere Q; the third implemen- 
tation (cps/pnr) is a new design that combines the 
perfect photon-number correlation in spontaneous down 
conversion |^ with photon-number resolving detectors 
(pnr) to reduce the effect of the multi-photon secu- 
rity loophole. Our calculations indicate that this novel 
design offers a substantial advantage over the competing 
implementations, mainly because of its closer approxima- 
tion to the true single-photon state. 

Most reports of the performance of specific qkd sys- 
tems either ignore the vulnerability of the system to 



eavesdropper attack or provide special-case analyses in 
which the information accessible to an eavesdropper em- 
ploying a specific attack is estimated. This runs counter 
to the fundamental paradigm of quantum cryptography. 
While conventional public-key cryptosystems are based 
on unproven propositions of theoretical computer sci- 
ence and can only be used against an adversary who 
has limited computational power, quantum cryptography 
promises unconditional security regardless of the tech- 
nological capabilities of the adversary. Thus, candidate 
QKD systems should be evaluated in this context. 

Our analysis places no technological limitations on the 
eavesdropper (Eve) except that she attacks each pulse 
individually. Although it is not yet proven, it it widely 
believed that restricting Eve to individual attacks does 
not prevent her from performing the optimal attack. The 
essence of the argument is that Eve's techniques for learn- 
ing information about any two pulses are in no way re- 
stricted by requiring her to gain information from each 
separately, since the two parties (Alice and Bob) are at- 
tempting to share a random bit string in which any two 
bits are completely uncorrelated. 



II. THE FIGURE OF MERIT: SECURE BITS PER 
PULSE 

The existence of classical privacy amplification algo- 
rithms for distilling arbitrarily secure bits from partially 
secure bits means that it is not necessary to have com- 
plete security for each pulse. As long as a bound on the 
information leaked to the adversary can be inferred from 
measurable quantities, such as the observed error rate, 
Alice and Bob can recover a perfectly secure, shared key 
by a two-step procedure. They first use traditional error- 
correcting methods to ensure they have the same key, and 
then use the technique of generalized privacy amplifica- 
tion Q to extract a shorter secure key from a longer key. 
Thus, the crucial figure of merit for QKD implementations 
is the fraction of the raw bits shared by Alice and Bob 
that may be kept, such that they are certain that they 
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share the same key and that Eve has negUgible informa- 
tion about that key. 

This fraction, labeled G for gain, depends on four fac- 
tors: the observed error rate (e), the probability that 
Alice's detector-triggered source indicates that a valid 
signal was created {ps)i the probability that Alice sends 
a multi-photon pulse {Sm), and the probability that a 
pulse sent by Alice leads to a successful detection by Bob 
(Pexp)- The dependence of G on e for the BB84 protocol 
faced with the aforementioned adversary was determined 
by C. Fuchs et al. in 1997 however, the more crucial 
dependence of G on ps, Sm, and Pexp has only recently 
been determined by Liitkenhaus Combining these 
two analyses, we have 



A. WCP 



G(e, Ps, S„i, Pexp) 
^PsPexp |--Rl l0g2 

+ 1.35[elog2 £+(!-£ log2(l-e)]} 



where Ri 



It should be noted that for this 



derivation of G, the most conservative approach to the 
imperfections in Bob's apparatus has been used: Eve has 
complete control over all of the errors, photon losses, 
background, and dark counts that occur in the optical 
channel and in Bob's detection unit. If it is assumed 
that Eve cannot control the imperfections in Bob's appa- 
ratus, the fraction G increases; however, it is difficult to 
prove exactly which aspects of Bob's apparatus Eve may 
or may not be able to influence. Thus, it seems prudent 
to assume the worst case, as we have done here. 



III. THREE QKD SOURCE DESIGNS 

A complete QKD implementation consists of the phys- 
ical apparatus and a protocol which specifies how the 
apparatus should be operated, and which provides prob- 
abilistic statements that characterize the outcome (i.e., 
with probability e. Eve's guess at the secret key will be 
correct in more than half of the bits). Since BB84 is 
the only protocol for which there exists an agreed-upon 
method for calculating G(e, Ps , Sm , Pexp) in the face of our 
adversary , we use this protocol exclusively in compar- 
ing the performance of the three implementations: wCP, 
CPS, and CPS/PNR. 

The physical apparatus required for the BB84 proto- 
col can be conveniently partitioned into the single-photon 
source, the optical channel, and the detection unit. Sev- 
eral single-photon source technologies are being consid- 
ered for use in a complete QKD system. Before presenting 
the results of our calculations, we summarize the quali- 
tative advantages and disadvantages of the three leading 
single-photon-source technologies. 
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FIG. 1. Three QKD source designs. In A, a weak co- 
herent pulse (wCP) from a laser source is optically attenuated 
(OA) to a mean photon number much less then one (the polar- 
ization rotator necessary for implementing the BB84 protocol 
is not shown). Both B and C are detector-triggered sources 
based on spontaneous parametric down conversion (spdc) in 
which Alice only allows the pulse in the signal beam to prop- 
agate to Bob if her detector indicates that one photon arrived 
in the idler beam. In B the idler beam is monitored with a 
standard "click" /"no click" detector. In C, the idler beam 
is monitored with a photon-number resolving detector (pnr), 
which can discriminate between single- and double-photon ar- 
rivals. By not using the pulses that she determines contain 
multiple photons, Alice significantly improves the secure bit 
rate and extends the range of tolerable channel loss. 



A. Weak Coherent Pulse (WCP) 

The simplest and most common method of reducing 
the probability of a multi-photon pulse is to attenu- 
ate a weak coherent pulse (wCP) of light from a laser 
(see Fig. |^A). Since a partitioned Poisson random vari- 
able still exhibits Poisson statistics, Alice must adjust 
the mean photon number per pulse in order to strike 
a balance between two undesirable effects: the wasteful 
zero-photon pulses and the insecure multi-photon pulses. 
Once the pulse is created, Alice and Bob may use stan- 
dard optical components to modify, launch, transmit, col- 
lect and measure the polarization of the optical pulse. 
Since the different sources we consider work equally well 
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with the other parts of the complete QKD apparatus, we 
leave these aspects of the apparatus unspecified and base 
our calculations on values for optical coupling efficiency, 
error probabilities, and detector performance reported in 
the literature 0-^2). 

B. Correlated Photon Source (CPS) 

In the paper that reveals the complete insecurity of 
current WCP implementations Brassard et al. inves- 
tigate the ability of a detector-triggered source based on 
spontaneous parametric down conversion (spdc) to mit- 
igate the multi-photon security loophole (see Fig. |^B). 
The perfect correlation in photon number in the signal 
and idler beams allows Alice to run the protocol only 
when her detectors on the idler beam indicate that one 
photon was sent to Bob along the signal beam. While this 
implementation of the correlated photon source (CPS) 
extends the range of permissible channel losses sev- 
eral orders of magnitude from that allowed in the wCP 
case the Poisson statistics for the number of pairs 

per pulse combined with the inability of standard de- 
tectors to distinguish single- and multi-photon detection 
events lead to a persistence of the insecure multi-photon 
pulses. 

C. Correlated Photon Source with a 
Photon-Number Resolving Detector (CPS/PNR) 

To minimize the chance that Alice registers a valid 
signal when more than one pair was created, we place 
a photon-number resolving detector in Alice's labora- 
tory. In our calculations we use the characteristics of the 
photon- number resolving detector reported in Ref. 0, 
since this device is representative of the state-of-the-art. 
While this detector has a finite quantum efficiency of 
approximately 70%, the gain mechanism ensures that 
the device can distinguish the number of photoelectron- 
multiplication events with very low error (~0.63%). The 
relatively high dark count rate (~10'* counts per second) 
can be effectively mitigated by limiting the detector's ex- 
posure time by nanosecond gating. By initiating a pulse 
transmission only when the detector reports one photon 
arriving, Alice significantly reduces the fraction of pulses 
sent to Bob that contain more than one photon. 

The difficulties with this approach stem from the ex- 
treme conditions necessary for the PNR to provide such 
high efficiency and low multiplication noise. The actively 
controlled, bath-type He cryostat required for optimal 
performance precludes miniaturization of the source 
and complicates the task of creating a QKD implemen- 
tation that is reliable, durable and economically feasibly 



for real-world applications. Nonetheless, our simulations 
indicate that, in achieving a closer approximation to the 
true single-photon source, the CPS/pnr implementation 
provides an option for obtaining a secure link for certain 
applications in which existing implementations provide 
negligible gain. 

IV. EXAMPLES 

We calculated the performance of the three implemen- 
tations over both free space and fiber-optic channels us- 
ing values for optical coupling efficiency, error probabil- 
ities, and detector performance reported in the litera- 
ture 1^^. In each case the performance was deter- 
mined by maximizing G over the power of the original 
laser pulses that are either attenuated (wCP) or down- 
converted (CPS and CPS/pnr) to create the pulse. It is 
this crucial step that most experimental groups have ig- 
nored, leading to mean photon numbers that are orders 
of magnitude away from optiniality and to unrealistic 
claims concerning secure bit rates. While the experi- 
ments have been performed at specific distances, we ex- 
trapolate the predicted gain over a range of distances by 
reasoning that the dependence of G on distance is domi- 
nated by absorption in optical fibers and diffraction in a 
free-space link. 

As graphed in Figs. ^ and||, each of the curves stops at 
a specific distance along the x-axis and fails to descend 
off the bottom of the plot, suggesting that there may be 
valid operating points with gain beyond the end of the 
curve. It should be understood that the true shape of 
these curves is nearly vertical at the cut-off distance — 
the plot fails to convey this steep drop-off because the 
numerical sampling algorithm used by the plotting pro- 
gram is not fine enough to show the curves' continuity. 

A. Free-Space QKD 

1. Ground-to- Ground Link 

Fig. ^A shows the relative performance of the three 
implementations along the surface of the Earth under 
nighttime conditions. The values of the gain at d = 1 
km (i.e., WCP-^ 5.6 x 10^"*, CPS^ 1.5 x 10"*, and 
CPS/PNR^ 4.2 X 10~^) represent the actual values that 
could be achieved using the experimental apparatus re- 
ported by Buttler et al. for signal launch, collection and 
detection ||l^. Thus, using a base repetition rate of 100 
MHz, the CPS/PNR implementation offers a 400 kbits/sec 
perfectly secure channel. The rate of this channel is ap- 
proximately one order of magnitude greater than that 
offered by the WCP and CPS implementations. The most 
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FIG. 2. Free-space QKD in ground-to-ground (A) and 
ground-to-satellite (B) c onfi gurations for the three 
source designs of Section 



III. 



The gain G represents the 
number of perfectly shared, secure bits, per pulse. Note the 
difference scales in A and B. The values at 1 km in A and 300 
km in B are based on the parameters for channel loss, error, 
and background reported in Ref. [^. The gain at all other 
distances is calculated by assuming that the optical coupling 
efficiency varies as ^ as a result of beam diffraction, where 
d is the distance of the transmission. 



dramatic feature in Fig. is the precipitous decline 
of the WCP gain around 2 km. The persistence of the 
CPS and CPS/PNR curves beyond 10 km suggest that a 
detector-triggered source would be required for secure 
communications in a metropohtan area or battlefield, 
while the wCP would be sufficient for close proximity, 
building-to-building applications. 



ground-to-satellite QKD application. Using these esti- 
mates, we have simulated the gain achievable with each 
implementation for a range of low-Earth orbit altitudes 
(see Fig. The apparent discrepancy between Fig. ||A 
and Fig. ffl3 — both describe free-space implementations, 
yet Fig. ]|B shows gain far past the 20-km cutoff of 
Fig. ^ — is understood by observing that all but the low- 
est 2 km of the ground-to-satellite link is turbulence-free 
vacuum. Our results indicate that while the wCP and CPS 
implementations offer no secure communication at stan- 
dard low Earth orbit altitudes (~100 km), the CPS/pnr 
implementation could enable the exchange of approxi- 
mately 10'^ secret bits for each nighttime exchange (as- 
suming a 10-MHz repetition rate, a 300-km orbit, and a 
several-minute line-of-sight exposure between the ground 
station and the satellite). 

A complicating factor in these estimates is that the 
satellite altitude determines the velocity necessary to re- 
main in orbit. While a very low orbit would allow in- 
creased gain, the amount of time that the satellite spends 
in sight of the ground station would be reduced, decreas- 
ing the total number of secret bits shared in one pass. 
It seems reasonable to delay a determination of the op- 
timal satellite altitude until the exact characteristics of 
each element in the proposed communication system are 
established. 



B. Optical Fiber QKD 

Figure § confirms the conclusion of Refs. ||J^: the 
detector-triggered source offers gain far beyond the '^10 
km cutoff distance of the WCP implementation through 
optical fiber. Unlike these papers which focused en- 
tirely on "click" /"no click" detectors in Alice's source, 
our results indicate the considerable increase in gain of- 
fered by photon-number resolving detectors. Comparing 
Fig. ^ to Fig. ||A, it is clear that fiber-based QKD of- 
fers performance superior to that of free-space QKD, and 
is the obvious choice for long-distance ground-to-ground 
applications, as a result of its immunity from diffrac- 
tion, background light, cloud cover, and temperature- 
dependent turbulence. However, given current technol- 
ogy, ground-to-satellite free-space QKD with a CPS/pnr 
source appears to be the preferred option for implement- 
ing a global, secure network. 



V. DISCUSSION 



2. Ground-to-Satellite Lmk 

In Buttler et al. provide rough estimates of the 
optical coupling efficiency and background rates in a 



We have calculated the performance currently attain- 
able with QKD systems through free-space and optical 
fibers, for three different source designs, in the face of an 
unrestricted adversary who attacks each pulse individu- 
ally. Our results indicate that the implementation based 
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Finally, we mention a subtle issue in quantum cryptog- 
raphy that has not, to our knowledge, been analyzed: the 
role of Alice's and Bob's prior distribution on the error 
rate (e) that Eve effects by her eavesdropping. In their 
attempts to determine e, Alice and Bob can only use the 
revealed outcome of a subset of the total transmission 
record to update an a priori distribution over e to an 
a posteriori distribution over e via Bayes' rule. While 
most practical analyses choose the uniform distribution 
over e as the a priori distribution. Eve can obviously use 
any distribution she likes to choose the value of e. Thus, 
it seems likely that a more sophisticated game-theoretic 
analysis would be required to plug this "a priori distri- 
bution loophole." 



FIG. 3. Gain through an op tical fiber for the three 



source designs of Section III, Transmission wavelength 



is set at the first telecom window (1.3 /xm) to achieve low 
loss (0.38 dB/km) and to optimize detector performance (the 
detectors used had quantum efficiency 0.11 and 10~^ dark 
counts per pulse duration). Detector-triggered sources (i.e., 
CPS and CPS/pnr) use idler beams at 0.8 /^m where detectors 
have higher efficiency and lower noise. Calculations are based 
on the experimental values provided in Refs. [ p^|Jll| . Note 
that the scales differ from those in Fig. ti 
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on a correlated photon source (CPS) offers the best perfor- 
mance, as a result of the potentially unlimited precision 
in identifying the presence of a single photon. Further- 
more, while using a detector-triggered source extends the 
range of a QKD system, exploiting the photon-number re- 
solving capabilities of a photon-number resolving detec- 
tor (pnr) to decrease the fraction of multi-photon pulses 
provides a further increase of several orders of magni- 
tude in G{e,ps, Sm,Pexp), as seen in Figs. || and ||. We 
conclude that future progress in practical QKD will come 
largely from advances in detector performance and in the 
attendant improvement in the detector-triggered single- 
photon source. 

A summary of our calculations is as follows. Using a 
base repetition rate of 100 MHz for the pump laser, the 
CPS/PNR implementation provides a 400-kbits/sec secure 
channel over 1 km of free space, 100 bits/sec over 50 km 
of optical fiber, and 100 bits/sec to a satellite in low 
earth orbit. The two competing implementations pro- 
vide at best only 50 kbits/sec over 1 km of free space, 
1 bits/sec over 50 km of optical fiber, and cannot safely 
communicate with a satellite at any rate. 

More accurate estimates of the dependence of free- 
space QKD performance on source characteristics and on 
the communication distance d can be obtained by ap- 
plying exis ting analyses of atmospheric effects on optical 
signals |l|-|l6|l. 
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